WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR vulnerability

Unauthenticated Image Attachment Disclosure via IDOR vulnerability discovered by Shivamani Vastrala in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.8.0...

WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR vulnerability

Unauthenticated Order Receipt Tampering via IDOR vulnerability discovered by Lyris Vale in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.8.0...

CVE-2026-14313

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14313

The PeproDev WooCommerce Receipt Uploader WordPress plugin (slug: pepro-bacs-receipt-upload-for-woocommerce) is vulnerable to an unauthenticated missing-authorization / IDOR write vulnerability in all versions up to and including 2.8.0 . This flaw allows for unauthenticated order receipt tamperin...

EUVD-2026-53718

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-14313

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

EUVD-2026-53719

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin (versions

CVE-2026-14313: Cross-Site Request Forgery (CSRF)

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

PT-2026-68393

Name of the Vulnerable Software and Affected Versions PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if a requested attachment belongs to the order associated with the provided access token...

PT-2026-68392

Name of the Vulnerable Software and Affected Versions PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 Description The plugin is vulnerable to an unauthenticated Insecure Direct Object Reference IDOR write, which occurs when an application provides direct access to objects based on...

CVE-2026-14314: Exposure of Sensitive Information to an Unauthorized Actor

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.6.9...

CVE-2025-24574

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through =...

CVE-2025-24574: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through =...

PT-2025-5415 · Peprodev · Peprodev Woocommerce Receipt Uploader

Name of the Vulnerable Software and Affected Versions: PeproDev WooCommerce Receipt Uploader versions prior to 2.6.9 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject...